// For flags

CVE-2020-8840

jackson-databind: Lacks certain xbean-reflect/JNDI blocking

Severity Score

9.8
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

5
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

FasterXML jackson-databind versiones 2.0.0 hasta 2.9.10.2, carece de cierto bloqueo de xbean-reflect/JNDI, como es demostrado mediante org.apache.xbean.propertyeditor.JndiConverter.

A flaw was found in FasterXML jackson-databind in versions 2.0.0 through 2.9.10.2. A "gadget" exploit is possible due to a lack of a Java object being blocking from being deserialized. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-02-10 CVE Reserved
  • 2020-02-10 CVE Published
  • 2020-02-21 First Exploit
  • 2024-06-05 EPSS Updated
  • 2024-08-04 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-502: Deserialization of Untrusted Data
CAPEC
References (51)
URL Tag Source
http://www.huawei.com/en/psirt/security-advisories/huawei-sa-20200610-01-fastjason-en Third Party Advisory
https://github.com/FasterXML/jackson-databind/issues/2620 Third Party Advisory
https://lists.apache.org/thread.html/r078e68a926ea6be12e8404e47f45aabf04bb4668e8265c0de41db6db%40%3Ccommits.druid.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r1c09b9551f6953dbeca190a4c4b78198cdbb9825fce36f96fe3d8218%40%3Cdev.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r1efc776fc6ce3387593deaa94bbdd296733b1b01408a39c8d1ab9e0e%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r2fa8046bd47fb407ca09b5107a80fa6147ba4ebe879caae5c98b7657%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r319f19c74e06c201b9d4e8b282a4e4b2da6dcda022fb46f007dd00d3%40%3Ccommits.druid.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r3539bd3a377991217d724879d239e16e86001c54160076408574e1da%40%3Cnotifications.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r3d20a2660b36551fd8257d479941782af4a7169582449fac1704bde2%40%3Ccommits.druid.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r428d068b2a4923f1a5a4f5fc6381b95205cfe7620169d16db78e9c71%40%3Cnotifications.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r446646c5588b10f5e02409ad580b12f314869009cdfbf844ca395cec%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r46bebdeb59b8b7212d63a010ca445a9f5c4e9d64dcf693cab6f399d3%40%3Ccommits.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r5d8bea8e9d17b6efcf4a0e4e194e91ef46a99f505777a31a60da2b38%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r65ee95fa09c831843bac81eaa582fdddc2b6119912a72d1c83a9b882%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r6fdd4c61a09a0c89f581b4ddb3dc6f154ab0c705fcfd0a7358b2e4e5%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r7762d69e85c58d6948823424017ef4c08f47de077644277fa18cc116%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r7e5c10534ed06bf805473ac85e8412fe3908a8fa4cabf5027bf11220%40%3Cdev.kafka.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r8170007fd9b263d65b37d92a7b5d7bc357aedbb113a32838bc4a9485%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r8e96c340004b7898cad3204ea51280ef6e4b553a684e1452bf1b18b1%40%3Cjira.kafka.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r94930e39b60fff236160c1c4110fe884dc093044b067aa5fc98d7ee1%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9e59ebaf76fd00b2fa3ff5ebf18fe075ca9f4376216612c696f76718%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/r9ecf211c22760b00967ebe158c6ed7dba9142078e2a630ab8904a5b7%40%3Cdev.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/ra275f29615f35d5b40106d1582a41e5388b2a5131564e9e01a572987%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rac5ee5d686818be7e7c430d35108ee01a88aae54f832d32f62431fd1%40%3Cnotifications.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb43f9a65150948a6bebd3cb77ee3e105d40db2820fd547528f4e7f89%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb5eedf90ba3633e171a2ffdfe484651c9490dc5df74c8a29244cbc0e%40%3Ccommits.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb73708bf714ed6dbc1212da082e7703e586077f0c92f3940b2e82caf%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rb99c7321eba5d4c907beec46675d52827528b738cfafd48eb4d862f1%40%3Cdev.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rc068e824654c4b8bd4f2490bec869e29edbfcd5dfe02d47cbf7433b2%40%3Cdev.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rc717fd6c65190f4e592345713f9ef0723fb7d71f624caa2a17caa26a%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rcc72b497e3dff2dc62ec9b89ceb90bc4e1b14fc56c3c252a6fcbb013%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rdea588d4a0ebf9cb7ce8c3a8f18d0d306507c4f8ba178dd3d20207b8%40%3Cdev.tomee.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rdf311f13e6356297e0ffe74397fdd25a3687b0a16e687c3ff5b834d8%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rdf8d389271a291dde3b2f99c36918d6cb1e796958af626cc140fee23%40%3Ccommits.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/re7326b8655eab931f2a9ce074fd9a1a51b5db11456bee9b48e1e170c%40%3Cissues.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/re8ae2670ec456ef1c5a2a661a2838ab2cd00e9efa1e88c069f546f21%40%3Ccommits.zookeeper.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2%40%3Cissues.geode.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rf28ab6f224b48452afd567dfffb705fbda0fdbbf6535f6bc69d47e91%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.apache.org/thread.html/rfc1ccfe89332155b72ce17f13a2701d3e7b9ec213324ceb90e79a28a%40%3Cdev.ranger.apache.org%3E Mailing List
https://lists.debian.org/debian-lts-announce/2020/02/msg00020.html Mailing List
https://security.netapp.com/advisory/ntap-20200327-0002 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2020.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Third Party Advisory
URL Date SRC
https://github.com/jas502n/jackson-CVE-2020-8840 2020-02-21
https://github.com/fairyming/CVE-2020-8840 2020-02-24
https://github.com/Veraxy00/CVE-2020-8840 2020-12-28
https://github.com/Blyth0He/CVE-2020-8840 2020-06-05
https://github.com/dpredrag/CVE-2020-8840 2021-01-26
URL Date SRC
URL Date SRC
https://access.redhat.com/security/cve/CVE-2020-8840 2020-10-27
https://bugzilla.redhat.com/show_bug.cgi?id=1816330 2020-10-27
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Huawei
Search vendor "Huawei"
 Oceanstor 9000 Firmware
Search vendor "Huawei" for product "Oceanstor 9000 Firmware"
 v300r006c20
Search vendor "Huawei" for product "Oceanstor 9000 Firmware" and version "v300r006c20"
-
Affected
in Huawei
Search vendor "Huawei"
 Oceanstor 9000
Search vendor "Huawei" for product "Oceanstor 9000"
--
Safe
Huawei
Search vendor "Huawei"
 Oceanstor 9000 Firmware
Search vendor "Huawei" for product "Oceanstor 9000 Firmware"
 v300r006c20spc100
Search vendor "Huawei" for product "Oceanstor 9000 Firmware" and version "v300r006c20spc100"
-
Affected
in Huawei
Search vendor "Huawei"
 Oceanstor 9000
Search vendor "Huawei" for product "Oceanstor 9000"
--
Safe
Huawei
Search vendor "Huawei"
 Oceanstor 9000 Firmware
Search vendor "Huawei" for product "Oceanstor 9000 Firmware"
 v300r006c20spc200
Search vendor "Huawei" for product "Oceanstor 9000 Firmware" and version "v300r006c20spc200"
-
Affected
in Huawei
Search vendor "Huawei"
 Oceanstor 9000
Search vendor "Huawei" for product "Oceanstor 9000"
--
Safe
Huawei
Search vendor "Huawei"
 Oceanstor 9000 Firmware
Search vendor "Huawei" for product "Oceanstor 9000 Firmware"
 v300r006c20spc300
Search vendor "Huawei" for product "Oceanstor 9000 Firmware" and version "v300r006c20spc300"
-
Affected
in Huawei
Search vendor "Huawei"
 Oceanstor 9000
Search vendor "Huawei" for product "Oceanstor 9000"
--
Safe
Fasterxml
Search vendor "Fasterxml"
 Jackson-databind
Search vendor "Fasterxml" for product "Jackson-databind"
 >= 2.0.0 < 2.7.9.7
Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.0.0 < 2.7.9.7"
-
Affected
Fasterxml
Search vendor "Fasterxml"
 Jackson-databind
Search vendor "Fasterxml" for product "Jackson-databind"
 >= 2.8.0 < 2.8.11.5
Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.8.0 < 2.8.11.5"
-
Affected
Fasterxml
Search vendor "Fasterxml"
 Jackson-databind
Search vendor "Fasterxml" for product "Jackson-databind"
 >= 2.9.0 < 2.9.10.3
Search vendor "Fasterxml" for product "Jackson-databind" and version " >= 2.9.0 < 2.9.10.3"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 8.0
Search vendor "Debian" for product "Debian Linux" and version "8.0"
-
Affected
Netapp
Search vendor "Netapp"
 Oncommand Api Services
Search vendor "Netapp" for product "Oncommand Api Services"
--
Affected
Netapp
Search vendor "Netapp"
 Oncommand Workflow Automation
Search vendor "Netapp" for product "Oncommand Workflow Automation"
--
Affected
Netapp
Search vendor "Netapp"
 Service Level Manager
Search vendor "Netapp" for product "Service Level Manager"
--
Affected
Netapp
Search vendor "Netapp"
 Steelstore Cloud Integrated Storage
Search vendor "Netapp" for product "Steelstore Cloud Integrated Storage"
--
Affected
Oracle
Search vendor "Oracle"
 Global Lifecycle Management Opatch
Search vendor "Oracle" for product "Global Lifecycle Management Opatch"
 < 11.2.0.3.23
Search vendor "Oracle" for product "Global Lifecycle Management Opatch" and version " < 11.2.0.3.23"
-
Affected
Oracle
Search vendor "Oracle"
 Global Lifecycle Management Opatch
Search vendor "Oracle" for product "Global Lifecycle Management Opatch"
 >= 12.2.0.1.0 < 12.2.0.1.19
Search vendor "Oracle" for product "Global Lifecycle Management Opatch" and version " >= 12.2.0.1.0 < 12.2.0.1.19"
-
Affected
Oracle
Search vendor "Oracle"
 Global Lifecycle Management Opatch
Search vendor "Oracle" for product "Global Lifecycle Management Opatch"
 >= 13.9.4.0.0 < 13.9.4.2.1
Search vendor "Oracle" for product "Global Lifecycle Management Opatch" and version " >= 13.9.4.0.0 < 13.9.4.2.1"
-
Affected